CVE-2026-9152: Altium 365 SearchService Missing Authentication on Legacy SOAP Endpoint (CWE-306)
The Altium 365 SearchService exposes a legacy SOAP endpoint that performs search index operations without authentication, according to the CVE record. A remote unauthenticated attacker who knows a target workspace identifier could read or alter that workspace's search index across tenant boundaries. The CNA assigns a CVSS v4.0 base score of 10, and the record states that on-premise Altium Enterprise Server is not affected.
Overview
The CVE record describes a missing authentication weakness (CWE-306) in the Altium 365 SearchService. A legacy SOAP endpoint exposes search index operations without requiring authentication, session tokens or identity verification. The issue is described as allowing one tenant's workspace search index to be reached by a network attacker who can reference that workspace's identifier. Details are taken from the CVE record on NVD and the Altium security advisories page.
Impact
The record states that successful exploitation could allow:
- Reading indexed workspace content, such as component data, project and folder names and user metadata.
- Injecting, modifying or deleting search index entries.
The record notes that the underlying vault data is not affected, but disclosure of sensitive workspace information and loss of integrity or availability of search results are possible. The CNA scores the issue 10 under CVSS v4.0 with high impact on confidentiality, integrity and availability for the vulnerable system and subsequent systems.
Affected products and versions
The record states that Altium 365 cloud deployments are affected and that on-premise Altium Enterprise Server is not affected. The record does not list specific affected or fixed versions, so the exact range of affected cloud service builds is unknown from the sources consulted.
Exploitation status
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog in the record. No confirmed exploitation appears in the sources consulted. The EPSS data in the record gives a low estimated probability of exploitation at the time of the record.
Remediation and mitigation
- Check the vendor's security advisories page for the status of the Altium 365 SearchService fix and any customer action required.
- Confirm with the vendor whether any workspace-level or tenant-level action is needed, because the record does not describe one.
- Treat any workspace search index content as potentially exposed until the vendor confirms the remediation status for your tenant.
- Limit network exposure of administrative and integration paths where your organisation has a choice, and review which external parties can reach your cloud tenant integrations.
Detection guidance
- Review available cloud service and integration logs for search-related requests that you cannot attribute to authenticated users or known integrations.
- Look for unexpected bulk reads or changes to search index content for workspaces, if such telemetry is available.
- Correlate any anomalies with the vendor's guidance once published, since the record does not describe specific indicators.
Limitations of the available information
The record does not list affected or fixed versions, patch availability, workaround details or indicators of compromise. The vendor advisory referenced in the record was not reviewed in detail for this analysis. Statements about cloud versus on-premise scope come from the record's description alone.
Frequently asked questions
What is CVE-2026-9152?
It is a missing authentication vulnerability (CWE-306) in the Altium 365 SearchService, where a legacy SOAP endpoint exposes search index operations without authentication, according to the CVE record.
Is on-premise Altium Enterprise Server affected?
The CVE record states that Altium 365 cloud deployments are affected and that on-premise Altium Enterprise Server is not affected.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.